If your organisation runs Microsoft 365 Copilot Enterprise, the past few weeks have delivered a stark security wake-up call. A critical vulnerability — now known as SearchLeak — allowed attackers to silently steal emails, multi-factor authentication (MFA) codes, SharePoint documents, and calendar data with nothing more than a single click on a legitimate-looking Microsoft link. Microsoft has patched the flaw, but the fallout for enterprise IT teams is far from over. Here's everything you need to know, and exactly what to do right now.

What Is SearchLeak? Understanding CVE-2026-42824

Security researchers at Varonis Threat Labs unveiled a critical vulnerability chain in Microsoft 365 Copilot Enterprise that could let attackers silently exfiltrate emails, MFA codes, calendar entries, and SharePoint documents simply by manipulating natural language prompts. Dubbed SearchLeak, the flaw earned the identifier CVE-2026-42824 and was patched by Microsoft after a coordinated disclosure process that concluded on June 15, 2026.

Uncovered by Varonis Threat Labs, the flaw earned Microsoft's maximum severity rating before being patched. Its significance lies less in any single bug than in how it fuses a new AI-specific weakness with two well-worn web security flaws, turning Copilot Enterprise Search into a silent exfiltration channel.

What makes SearchLeak particularly alarming is just how invisible the attack is to victims.

From the victim's perspective, all they see is Copilot "thinking" for a moment, but there is no indication that data is being exfiltrated.

By the time anyone notices something might be wrong, it's already too late.

How the Attack Chain Actually Works

SearchLeak chains three distinct weaknesses: a Parameter-to-Prompt (P2P) Injection, an HTML rendering race condition, and a CSP bypass via Bing Server-Side Request Forgery (SSRF) into a seamless, one-click data theft path.

Here's how it plays out step by step:

The flaw is that whatever value is placed in the q URL parameter is interpreted by Copilot's AI engine not just as a search string, but as executable instructions. An attacker crafts a malicious URL that points to a trusted microsoft.com domain and commands Copilot to search the victim's mailbox and embed the extracted data in an image URL.

During the response streaming, an HTML rendering race condition allows an attacker-controlled image tag to execute, embedding the exfiltrated data within an image URL.

This URL is then sent to Bing's "Search by Image" feature, which bypasses CSP protections and fetches the data from the attacker's endpoint.

Because the attack originates from a real microsoft.com domain, conventional anti-phishing tools and URL filters fail to flag it entirely. No plugins, no elevated permissions, and no second click from the victim are required.

The Scope of What Could Be Stolen

This wasn't a vulnerability that merely exposed metadata or low-sensitivity records.

Researchers confirmed that the exploit could retrieve two-factor authentication codes, emails, SharePoint documents, OneDrive files, meeting notes, and any other content the targeted user had access to within the Microsoft 365 environment.

Since SearchLeak targets the Enterprise tier of Microsoft, the blast radius isn't limited to personal data — it's able to surface anything the user has access to inside the organisation, including emails, meeting invites and notes, and SharePoint documents.

For organisations with sprawling Microsoft 365 permissions, this is especially dangerous.

Varonis' research also highlights a critical issue: data that Copilot indexes but shouldn't. Many organisations have sprawling permissions in Microsoft 365, where old SharePoint sites or Teams channels are accessible to large groups. Copilot can inadvertently expose that data.

A Timeline of Discovery and Patch

Understanding when this happened matters for your incident response planning.

The key milestones were: Varonis Threat Labs discovered the vulnerability on February 3, 2026 during a routine red team exercise; the initial disclosure report was submitted to Microsoft's Security Response Center (MSRC) on February 10; Microsoft reproduced the issue and began developing a fix in March 2026; a preview fix was deployed to select early-update tenants for validation on May 28; the official security update was released for all Microsoft 365 customers on June 9; and Varonis published its full technical breakdown, including detection guidance and post-patch best practices, on June 15, 2026.

The good news:

Microsoft's fix was applied on the service side, which means most users did not need to install an update, restart Windows, or call the helpdesk.

However, the fact that the patch was server-side should not be confused with a clean bill of health for your Copilot environment.

Why This Is Part of a Bigger AI Security Problem

SearchLeak is not an isolated incident — it's part of a growing and alarming pattern of AI-specific attack classes targeting Microsoft Copilot.

This attack pattern closely parallels CVE-2025-32711 (EchoLeak), discovered by Aim Security, in which hidden prompts inside emails caused Microsoft 365 Copilot to exfiltrate sensitive data via crafted image URLs, demonstrating that XPIA against AI summarisation tools is a repeatable, cross-platform vulnerability class, not an isolated incident.

Instead of exploiting code vulnerabilities to achieve remote code execution or traditional data theft, attackers are increasingly turning to a new class of "logical" vulnerabilities that manipulate the intended functionality of AI to achieve malicious results.

The discovery underscores a growing class of AI-specific threats where large language model (LLM) orchestrators become unwitting accomplices in data theft. Unlike traditional software bugs, prompt injection exploits the very flexibility that makes generative AI powerful.

The awkward part for Microsoft is not merely that Copilot had another bug. It is that the bug sat at the junction of AI prompting, web security, identity, and enterprise data access — exactly where Microsoft has been telling customers Copilot is safe enough to become part of daily work.

Practical Tips: What IT Teams Must Do Right Now

The patch is live — but a closed ticket doesn't mean a secure environment.

Cloud patches solve the specific bug; they do not solve the operating model that made the bug valuable. Copilot's access is governed by the permissions, labels, sharing links, and retention habits already present inside Microsoft 365. That means IT teams should treat SearchLeak as a prompt to review exposure, not merely as a closed ticket.

Here are the immediate actions your security team should prioritise:

Security teams should use tools like Microsoft Purview to regularly audit and tighten data access controls.

Legacy SharePoint sites, over-shared Teams channels, and inherited permissions are feeding Copilot data it shouldn't be touching.

The June patch also introduced "AI Request Verification," a feature that requires Copilot to present a user-facing confirmation dialog whenever it is about to send data to an external endpoint. Administrators can enforce this as a mandatory policy, which Varonis recommends for high-security environments.

Varonis recommends security teams monitor Copilot Search URLs for encoded payloads in the q parameter containing HTML or image-embedding instructions, and audit CSP allowlists for any domain that performs server-side fetches on user-supplied data.

Log every prompt processed, every tool called, every file accessed, and every decision made. Without this traceability, reconstructing abnormal behaviour or replaying an incident after the fact is not possible.

Set up custom data loss prevention (DLP) policies specifically for Microsoft Copilot to act as real-time filters, blocking employees from entering highly regulated strings — such as Social Security numbers or credit card details — into the prompt window.

Enterprise security teams should not only confirm the June 2026 patch is applied but also schedule a full audit of their Copilot environment. Review permissions, enable monitoring, and prepare for the next AI vulnerability — because there will be one.

Conclusion: The AI Attack Surface Is Here to Stay

SearchLeak is a defining moment for enterprise AI security.

The vulnerability chain dubbed SearchLeak exposed the dark side of AI-powered productivity tools — showing how the very feature designed to help workers find information could be weaponised to steal it. Microsoft has already patched the bug, urging all organisations to apply the June 2026 security updates immediately. But the findings are a stark reminder that every new AI integration widens the attack surface, especially when that AI has direct access to the crown jewels of enterprise data.

The message from every leading security researcher is unanimous: patching is the floor, not the ceiling.

Microsoft's patch closes the specific attack path Varonis documented. It does not change the underlying architecture that made the attack possible, and researchers are explicit that new exploit chains targeting the same fundamental weakness remain a real concern.

Is your Microsoft 365 Copilot environment truly secure? Don't wait for the next CVE to find out. Conduct a full Copilot security audit, tighten your permissions, enable the new AI Request Verification controls, and build AI governance into your ongoing security programme — not as an afterthought, but as a priority. If you need expert guidance on securing your Microsoft 365 environment, now is the time to act. Contact a qualified Microsoft security partner today and ensure your organisation stays one step ahead of the next AI-powered attack.